CVE-2026-46495

Name of the Vulnerable Software and Affected Versions OpenDJ Community Edition versions prior to 5.1.1

Description A Deserialization of Untrusted Data issue in the JMX RMI connector allows an unauthenticated remote attacker to deserialize arbitrary Java objects on the server. The issue occurs because the platform processes attacker-controlled bytes before authentication. This affects systems where the JMX Connection Handler is enabled, which is often done for monitoring integrations. Successful exploitation leads to Remote Code Execution (RCE), the severity of which depends on the Java version and runtime classpath.

Recommendations Update to version 5.1.1. As a temporary mitigation, disable the JMX Connection Handler if it is not required for monitoring.